-
onlyoffice: bind temp file server to bridge IP, silence handler tracebacks, self-limit lifetime
LeoVasanko released this
2026-09-10 20:22:41 +00:00 | 3 commits to main since this releaseThe temporary HTTP server that OnlyOffice downloads the source document
from was bound to 0.0.0.0, so internet scanners could (and did) connect,
and socketserver dumped a full traceback to stderr for every dropped
connection. It also stayed up for the whole conversion attempt, leaving
the port exposed when conversions hang.- Bind only to the callback host (oonet gateway by default) so the port
is unreachable from the internet. - Override handle_error to log at debug level instead of printing
tracebacks. - Watchdog shuts the server down ~2s after the file is fetched, or at
max_lifetime (request_timeout + 30s), and the socket is closed with
server_close() in the normal path.
Downloads
- Bind only to the callback host (oonet gateway by default) so the port